Introduction

Everything your own software needs to read your people, organisation and time off from andteam.

The andteam API is read-only. It gives another system the directory andteam holds: employees, companies, the organisation’s structure, positions, locations, lookups and approved time off. It tells that system when a person joins, changes or leaves, by signed webhooks or by a feed you read. Create a key in your andteam console, point it at the base URL below, and every endpoint is described in full in the API reference.

​

The basics

Base URL	https://api.v3.andteam.com/v1
Authentication	Authorization: Bearer atk_live_…. See Authentication.
Format	JSON. Every refusal is application/problem+json. See Errors.
Rate limit	300 requests a minute per key, 1,200 a minute per tenant. See Rate limits.
Lists	limit (1 to 500) and an opaque cursor. See Pagination.
Version	/v1. See Versioning.

​

Make a first call

Your andteam administrator creates a key under Settings, Integrations, API keys in the console at https://{your-company}.andteam.com/admin/settings/tenant/integrations. The secret is shown once. Then:

curl

curl "https://api.v3.andteam.com/v1/employees?limit=2" \
  -H "Authorization: Bearer atk_live_…"

The answer is a page: { "data": [...], "next_cursor": "..." }. A field the key may not read is left out, not sent as null: see Field groups.

​

What the API never carries

ID or passport numbers, tax numbers, bank details, pay and pay history, health notes and sick notes, performance, help questions and documents. They are not a field group and there is nothing to switch on.

​

The OpenAPI document

The OpenAPI document is at GET /v1/openapi.json on the API host. It needs no key. The reference on this site is rendered from it, and you can generate a client from it.

​

Before the first call

• Authentication: keys, companies, field groups, IP allow-list, expiry, roll and revoke.
• Field groups: what each group opens, and why a field can be absent.
• Pagination and syncing: reading everything, then only what changed.
• Webhooks: verify every delivery before you act on it.